Fortinet FortiGate FortiGate-3000 Installation Manual
  1. Manuals
  2. Brands
  3. Fortinet Manuals
  4. Firewall
  5. FortiGate 3000
  6. Installation manual
Fortinet FortiGate FortiGate-3000 Installation Manual

Fortinet FortiGate FortiGate-3000 Installation Manual

Fortinet fortigate fortigate-3000: install guide
Hide thumbs Also See for FortiGate FortiGate-3000:
Table of Contents

Advertisement

Quick Links

Download this manual See also: Administration Manual, Installation Manual
FortiGate 3000

Installation Guide

Esc
Enter
1
2
3
Version 2.80 MR5
01 November 2004
01-28005-0026-20041101
POWER
1
2
3
Hi-Temp
4/HA
INT
EXT
4/HA
INTERNAL
EXTERNAL

Advertisement

Table of Contents
loading
Need help?

Need help?

Do you have a question about the FortiGate FortiGate-3000 and is the answer not in the manual?

Questions and answers

Related Manuals for Fortinet FortiGate FortiGate-3000

Summary of Contents for Fortinet FortiGate FortiGate-3000

  • Page 1: Installation Guide

    FortiGate 3000 Installation Guide POWER Enter Hi-Temp 4/HA Version 2.80 MR5 01 November 2004 01-28005-0026-20041101 4/HA INTERNAL EXTERNAL...
  • Page 2 CAUTION: RISK OF EXPLOSION IF BATTERY IS REPLACED BY AN INCORRECT TYPE. DISPOSE OF USED BATTERIES ACCORDING TO THE INSTRUCTIONS. For technical support, please visit http://www.fortinet.com. Send information about errors or omissions in this document or any Fortinet technical documentation to techdoc@fortinet.com.

  • Page 3: Table Of Contents

    Command line interface ... 7 Setup wizard ... 7 Document conventions ... 7 Fortinet documentation ... 9 Comments on Fortinet technical documentation... 9 Customer service and technical support... 10 Getting started ... 11 Package contents ... 11 Mounting ... 12 Turning the FortiGate unit power on and off ...
  • Page 4 High availability configuration settings ... 47 Configuring FortiGate units for HA using the web-based manager ... 49 Configuring FortiGate units for HA using the CLI... 50 Connecting the cluster to your networks... 51 Installing and configuring the cluster... 52 Index ... 55 01-28005-0026-20041101 Fortinet Inc.

  • Page 5: Introduction

    • • The FortiGate Antivirus Firewall uses Fortinet’s Accelerated Behavior and Content Analysis System (ABACAS™) technology, which leverages breakthroughs in chip design, networking, security, and content analysis. The unique ASIC-based architecture analyzes content and behavior in real-time, enabling key applications to be deployed right at the network edge where they are most effective at protecting your networks.

  • Page 6: Secure Installation, Configuration, And Management

    The saved configuration can be restored at any time. Figure 1: Example of the FortiGate web-based manager login the web-based manager, the front panel control buttons and LCD, the command line interface (CLI), or the setup wizard. 01-28005-0026-20041101 Introduction Fortinet Inc.

  • Page 7: Command Line Interface

    Introduction Command line interface You can access the FortiGate command line interface (CLI) by connecting a management computer serial port to the FortiGate RS-232 serial console connector. You can also use Telnet or a secure SSH connection to connect to the CLI from any network that is connected to the FortiGate unit, including the Internet.
  • Page 8 In most cases to make changes to lists that contain options separated by spaces, you need to retype the whole list including all the options you want to apply and excluding all the options you want to remove. 01-28005-0026-20041101 Introduction Fortinet Inc.

  • Page 9: Fortinet Documentation

    FortiGate unit. For a complete list of FortiGate documentation visit Fortinet Technical Support at http://support.fortinet.com. Comments on Fortinet technical documentation You can send information about errors or omissions in this document, or any Fortinet technical documentation, to techdoc@fortinet.com. FortiGate-3000 Installation Guide...

  • Page 10: Customer Service And Technical Support

    Fortinet technical support web site at http://support.fortinet.com. You can also register FortiGate Antivirus Firewalls from http://support.fortinet.com and change your registration information at any time. Fortinet email support is available from the following addresses: amer_support@fortinet.com For customers in the United States, Canada, Mexico, Latin...

  • Page 11: Getting Started

    Factory default FortiGate configuration settings Planning the FortiGate configuration Next steps FortiGate-3000 Antivirus Firewall one red crossover ethernet cable (Fortinet part number CC300248) one gray regular ethernet cable (Fortinet part number CC300249) one null modem cable (Fortinet part number CC300247) FortiGate-3000 QuickStart Guide...

  • Page 12: Mounting

    The FortiGate-3000 unit may overload your supply circuit and impact your overcurrent protection and supply wiring. Use appropriate equipment nameplate ratings to address this concern. Make sure that the FortiGate-3000 unit has reliable earthing. Fortinet recommends direct connections to the branch circuit. 01-28005-0026-20041101...

  • Page 13: Turning The Fortigate Unit Power On And Off

    Getting started Environmental specifications • • • • Air flow • • Mechanical loading • Turning the FortiGate unit power on and off To power on the FortiGate unit Connect the power cables to the power connections on the back of the FortiGate unit. Connect the power cables to power outlets.

  • Page 14: Connecting To The Web-Based Manager

    The interface is connected at 1000 Mbps. No link established. execute shutdown a computer with an ethernet connection, Internet Explorer version 4.0 or higher, a crossover cable or an ethernet hub and two ethernet cables. 01-28005-0026-20041101 Getting started Fortinet Inc.

  • Page 15: Config System Interface

    The Register Now window is displayed. Use the information in this window to register your FortiGate unit so that Fortinet can contact you for firmware updates. You must also register to receive updates to the FortiGate virus and attack definitions.

  • Page 16: Connecting To The Command Line Interface (Cli)

    Type admin in the Name field and select Login. The Register Now window is displayed. It is important to register the Fortigate unit so that Fortinet can contact the unit for firmware updates. You must register to receive updates to the FortiGate antivirus and attack definitions.

  • Page 17: Factory Default Fortigate Configuration Settings

    Getting started Make sure that the FortiGate unit is powered on. Start HyperTerminal, enter a name for the connection, and select OK. Configure HyperTerminal to connect directly to the communications port on your computer and select OK. Select the following port settings and select OK. Bits per second 9600 Data bits Parity...

  • Page 18: Factory Default Nat/Route Mode Network Configuration

    Primary DNS Server Secondary DNS Server 01-28005-0026-20041101 Getting started Table 2, HTTPS admin (none) 192.168.1.99 255.255.255.0 HTTPS, Ping 192.168.100.99 255.255.255.0 Ping 0.0.0.0 0.0.0.0 Ping 0.0.0.0 0.0.0.0 Ping 0.0.0.0 0.0.0.0 Ping 0.0.0.0 0.0.0.0 Ping 192.168.100.1 external 207.192.200.1 207.192.200.129 Fortinet Inc.

  • Page 19: Factory Default Transparent Mode Network Configuration

    Getting started Factory default Transparent mode network configuration In Transparent mode, the FortiGate unit has the default network configuration listed in Table Table 3: Factory default Transparent mode network configuration Administrator account Management IP Administrative access Factory default firewall configuration FortiGate firewall policies control how all traffic is processed by the FortiGate unit.

  • Page 20: Factory Default Protection Profiles

    To apply no scanning, blocking or IPS. Use if you do not want to apply content protection to content traffic. You can add this protection profile to firewall policies for connections between highly trusted or highly secure networks where content does not need to be protected. 01-28005-0026-20041101 Getting started Fortinet Inc.

  • Page 21: Planning The Fortigate Configuration

    NAT/Route mode (the default) or Transparent mode. NAT/Route mode In NAT/Route mode, the FortiGate unit is visible to the network. Like a router, all its interfaces are on different subnets. The following interfaces are available in NAT/Route mode: •...

  • Page 22: Nat/Route Mode With Multiple External Network Connections

    Internal network FortiGate-3000 Unit Internal in NAT/Route mode 192.168.1.99 POWER Enter Hi-Temp 4/HA 4/HA INTERNAL EXTERNAL Port 3 10.10.10.1 traffic between internal and external networks. Getting started 192.168.1.3 Route mode policies controlling traffic between internal networks. DMZ network 10.10.10.2 Fortinet Inc.

  • Page 23: Transparent Mode

    The management IP address is also used for antivirus and attack definition updates. You typically use the FortiGate unit in Transparent mode on a private network behind an existing firewall or behind a router. The FortiGate unit performs firewall functions, IPSec VPN, virus scanning, IPS, web content filtering, and Spam filtering.

  • Page 24: Configuration Options

    DNS server IP addresses add the DHCP server settings and IP addresses add various internal server IP addresses including web, IMAP, POP3, SMTP, and FTP servers set the antivirus protection to high, medium, or none 01-28005-0026-20041101 Getting started Fortinet Inc.

  • Page 25: Next Steps

    Getting started If you are configuring the FortiGate unit to operate in Transparent mode, you can switch to Transparent mode from the web-based manager and then use the setup wizard to add the administration password, the management IP address and gateway, and the DNS server addresses.
  • Page 26 Next steps Getting started 01-28005-0026-20041101 Fortinet Inc.

  • Page 27: Preparing To Configure The Fortigate Unit In Nat/Route Mode

    NAT/Route mode installation This chapter describes how to install the FortiGate unit in NAT/Route mode. For information about installing a FortiGate unit in Transparent mode, see mode installation” on page units in HA mode, see about installing the FortiGate unit in NAT/Route mode, see configuration”...

  • Page 28: Dhcp Or Pppoe Configuration

    The default gateway directs all non-local traffic to this interface and to the external network. Primary DNS Server: Secondary DNS Server: 01-28005-0026-20041101 NAT/Route mode installation _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ Table 2 Fortinet Inc.

  • Page 29: Using The Web-Based Manager

    NAT/Route mode installation Using the web-based manager You can use the web-based manager for the initial configuration of the FortiGate unit. You can also continue to use the web-based manager for all FortiGate unit settings. For information about connecting to the web-based manager, see web-based manager”...

  • Page 30: Using The Front Control Buttons And Lcd

    The default route is not required if the interface connected to the external network is configured using DHCP or PPPoE. Go to System > Router > Static. If the Static Route table contains a default route (IP and Mask set to 0.0.0.0), select the Delete icon to delete this route.

  • Page 31: Using The Command Line Interface

    NAT/Route mode installation After you set the last digit of the IP address, press Enter. Use the down arrow to highlight Netmask. Press Enter and set the internal Netmask. After you set the last digit of the Netmask, press Enter. Press Esc to return to the Main Menu.
  • Page 32 <204.23.1.5> <255.255.255.0> config system interface edit external set mode dhcp config system interface edit external set mode pppoe set connection enable set username <name_str> set password <psswrd> 01-28005-0026-20041101 NAT/Route mode installation 28. Enter: Table 5 on page Fortinet Inc.
  • Page 33 <address_ip> set secondary <address_ip> config system dns set primary 293.44.75.21 set secondary 293.44.75.22 config router static edit 1 set dst 0.0.0.0 0.0.0.0 set gateway <gateway_IP> set device <interface> config router static edit 1 set dst 0.0.0.0 0.0.0.0...

  • Page 34: Using The Setup Wizard

    POP3 server IMAP server, or FTP server installed on an internal network, add the IP addresses of the servers here. 01-28005-0026-20041101 NAT/Route mode installation for other settings. Table 5 on page Table 5 on page _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ _____._____._____._____ Fortinet Inc.

  • Page 35: Starting The Setup Wizard

    Table 5 on page 28 Table 8 on page 34 Internal for connecting to the internal network, External for connecting to your public switch or router and the Internet. 01-28005-0026-20041101 Connecting the FortiGate unit to the network(s) Create a protection profile that enables virus scanning, file blocking, and blocking of oversize email for HTTP, FTP, IMAP, POP3, and SMTP.
  • Page 36 To connect the FortiGate-3000 unit running in NAT/Route mode Connect the Internal interface to the hub or switch connected to the internal network. Connect the External interface to your public switch or router. Optionally, connect interfaces 1, 2, 3, and 4/HA to networks.

  • Page 37: Configuring The Networks

    NAT/Route mode installation Configuring the networks If you are running the FortiGate unit in NAT/Route mode, the networks must be configured to route all Internet traffic to the IP address of the FortiGate interface to which they are connected. If you are using the FortiGate unit as the DHCP server for your internal network, configure the computers on your internal network for DHCP.
  • Page 38 After purchasing and installing a new FortiGate unit, you can register the unit by going to the System Update Support page, or using a web browser to connect to http://support.fortinet.com and selecting Product Registration. To register, enter your contact information and the serial numbers of the FortiGate units that you or your organization have purchased.

  • Page 39: Transparent Mode Installation

    Transparent mode installation This chapter describes how to install a FortiGate unit in Transparent mode. If you want to install the FortiGate unit in NAT/Route mode, see page availability installation” on page FortiGate unit in Transparent mode, see page This chapter describes: •...

  • Page 40: Using The Web-Based Manager

    The management IP address and netmask must be valid for the network from which you will manage the FortiGate unit. Add a default gateway if the FortiGate unit must connect to a router to reach the management computer. Primary DNS Server: Secondary DNS Server: _____._____._____._____...

  • Page 41: Reconnecting To The Web-Based Manager

    Otherwise, you can reconnect to the web-based manager by browsing to https://10.10.10.1. If you connect to the management interface through a router, make sure that you have added a default gateway for that router to the management IP default gateway field.

  • Page 42: Using The Command Line Interface

    Operation mode: Transparent Table 9 on page 40. Enter: config system manageip set ip <address_ip> <netmask> config system manageip set ip 10.10.10.2 255.255.255.0 get system manageip 01-28005-0026-20041101 Transparent mode installation 16. Use the to complete the following Fortinet Inc.

  • Page 43: Using The Setup Wizard

    FortiGate-3000 Installation Guide config system dns set primary <address_ip> set secondary <address_ip> config system dns set primary 293.44.75.21 set secondary 293.44.75.22 config router static edit 1 set dst 0.0.0.0 0.0.0.0 set gateway <address_gateway> set device <interface> config router static edit 1 set dst 0.0.0.0 0.0.0.0...

  • Page 44: Reconnecting To The Web-Based Manager

    Otherwise, you can reconnect to the web-based manager by browsing to https://10.10.10.1. If you connect to the management interface through a router, make sure that you have added a default gateway for that router to the management IP default gateway field.

  • Page 45: Next Steps

    Optionally, select Automatically adjust clock for daylight saving changes check box. Select Set Time and set the FortiGate system date and time. FortiGate-3000 Installation Guide Other Network (optional) Enter FortiGate-3000 01-28005-0026-20041101 Internal Network Hub, Switch or Router Port 1 Internal POWER Hi-Temp 4/HA 4/HA INTERNAL EXTERNAL External...
  • Page 46 After purchasing and installing a new FortiGate unit, you can register the unit by going to the System Update Support page, or using a web browser to connect to http://support.fortinet.com and selecting Product Registration. To register, enter your contact information and the serial numbers of the FortiGate units that you or your organization have purchased.

  • Page 47: High Availability Installation

    High availability installation This chapter describes how to install two or more FortiGate units in an HA cluster. HA installation involves three basic steps: • • • For information about HA, see the FortiGate Administration Guide and the FortiOS High Availability technical note. Priorities of heartbeat device and monitor priorities The procedures in this chapter do not include steps for changing the priorities of heartbeat devices or for configuring monitor priorities settings.
  • Page 48 Load balancing according to IP address and port. If the FortiGate units are connected using switches, select IP Port to distribute traffic to units in a cluster based on the Source IP, Source Port, Destination IP, and Destination port of the packet. 01-28005-0026-20041101 High availability installation Fortinet Inc.

  • Page 49: Configuring Fortigate Units For Ha Using The Web-Based Manager

    High availability installation Configuring FortiGate units for HA using the web-based manager Use the following procedure to configure each FortiGate unit for HA operation. To change the FortiGate unit host name Changing the host name is optional, but you can use host names to identify individual cluster units.

  • Page 50: Configuring Fortigate Units For Ha Using The Cli

    <password_str> set schedule {hub | ip | ipport | leastconnection | none | random | round-robin | weight-round-robin} “Connecting the cluster to your networks” on page config system global set opmode transparent 01-28005-0026-20041101 High availability installation Fortinet Inc.

  • Page 51: Connecting The Cluster To Your Networks

    Then you must connect these interfaces to their networks using the same hub or switch. Fortinet recommends using switches for all cluster connections for the best performance. Inserting an HA cluster into your network temporarily interrupts communications on the network because new physical connections are being made to route traffic through the cluster.

  • Page 52: Installing And Configuring The Cluster

    “Transparent mode installation” on page 39 01-28005-0026-20041101 High availability installation Internal External POWER Enter Hi-Temp 4/HA 4/HA INTERNAL EXTERNAL Hub or Switch POWER Enter Hi-Temp 4/HA 4/HA INTERNAL EXTERNAL Internal External Internet to install the cluster on your network. Router “NAT/Route Fortinet Inc.
  • Page 53 High availability installation When you connect to the cluster, you are actually connecting to the primary cluster unit. The cluster automatically synchronizes all configuration changes to the subordinate units in the cluster as the changes are made. The only configuration settings that are not synchronized are the HA configuration (except for the interface heartbeat device and monitoring configuration) and the FortiGate host name.
  • Page 54 Installing and configuring the cluster High availability installation 01-28005-0026-20041101 Fortinet Inc.

  • Page 55: Index

    (Transparent mode) 43 environmental specifications 13 firewall setup wizard 6, 29, 34, 40, 43 starting 29, 35, 40, 44 Fortinet customer service 10 front keypad and LCD configuring IP address 41 configuring FortiGate units for HA operation 47 connecting an HA cluster 51, 52...
  • Page 56 Index 01-28005-0026-20041101 Fortinet Inc.

Table of Contents